coinbasewalletcloud[.]created[.]app

The domain coinbasewalletcloud.created.app was registered through Tucows Domains Inc. on July 12, 2023 and is currently marked offline. DNS resolution points to the IP address 216.150.16.1, which belongs to Amazon.com, Inc. (AS16509) in the United States. The authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating that the site was hosted on the Vercel platform. Vercel detection correlates with the presence of HTTP Strict Transport Security (HSTS) and a valid SSL certificate issued by Let’s Encrypt (R13).

An HTTP request to the domain returns a 404 status code, suggesting that the malicious landing page is no longer accessible. The page title observed in historical records reads "Coinbase Wallet Extension – Connect to dApps Seamlessly," directly referencing Coinbase and reinforcing the brand impersonation claim. Google Safe Browsing flags the domain for social engineering, and VirusTotal records nine positive detections out of ninety‑five scanned scanners, confirming malicious activity. The domain appears on one security blocklist and has been actively blocked by PhishDestroy.

The identified threat aligns with an investment‑scam narrative targeting Coinbase users. Analysts should treat the infrastructure as compromised: block the domain and its associated IP at perimeter defenses, add the domain to internal phishing and malware blocklists, and monitor for other Vercel‑hosted subdomains that reference Coinbase or cryptocurrency services. Continuous observation of Amazon‑owned IP ranges for similar patterns is advised, as threat actors often recycle cloud resources. Because the site is offline, takedown verification is not possible, but the documented evidence warrants proactive defensive measures to prevent future exploitation of the same hosting configuration.